Vibe coding has created a security epidemic. (And I’m partially to blame) When we launched GitHub Copilot in 2021, it combined GPT’s code generation with GitHub’s data. It could auto-complete a function from just its docstring. 5 years on, AI coding agents are orders of magnitude more powerful. Now a single prompt can send Astra or Fable off to write 1000s of lines of code without human intervention. These models are trained on public source code, which doesn’t follow secure coding best practices. They generate more vulnerabilities than seasoned professionals would. Almost half of AI-written code fails basic security tests. If you're shipping AI-written code, here's what I'd do: 1. Embed secure coding in your agents. Don't leave it to each developer to remember. Write your secure coding requirements into the prompts every coding agent in your org runs with. Then review AI-written code with the same rigor as human-written code. 2. Closely scrutinize access controls. AI is getting better at avoiding textbook bugs. Where it still struggles is your business logic: who should see what, and who can do what. We recently tested an app where users upload documents for AI analysis. Nobody told the AI the documents should be private, so every user could see everyone else's… 3. Runtime testing at the speed you ship. If agents write code around the clock, an annual pentest is not enough. Security testing has to be continuous and automated. 4. Assume attackers are already deploying autonomous attacks. They won't tell you what they find. You need to find it first.